a235c1f7963c83bbf2bdef425eb6f618446afa6f40fde075a21029ac0a853c2e

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 14:46

Target

0209a4e555ed7df3fb6cd315022cf20b.exe
Size

39KB
MD5

0209a4e555ed7df3fb6cd315022cf20b
SHA1

86ea56de23225a9c8a9ab3e03851765ea9d8c76f
SHA256

a235c1f7963c83bbf2bdef425eb6f618446afa6f40fde075a21029ac0a853c2e
SHA512

432d70f6260342ad2c8cd78d16e92680283a520a1210fd432f75d80dd2f2a2d605de5be7932ee7c7c43ef1f681020fbf5743602e5849fd893ad394d8a9947740
SSDEEP

768:AXdZbSvLHsaDh8noZz2m7LsB089yvYvBWje8YLgWiLSege83/sv43:AXGD5ooV2NB0QvBWrWLTp3/U4

Score

5^/10

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winnet.exe	0209a4e555ed7df3fb6cd315022cf20b.exe
File opened for modification	C:\Windows\SysWOW64\winnet.exe	0209a4e555ed7df3fb6cd315022cf20b.exe
File opened for modification	C:\Windows\SysWOW64\xcopy.exe	0209a4e555ed7df3fb6cd315022cf20b.exe
File created	C:\Windows\SysWOW64\winnet.dll	0209a4e555ed7df3fb6cd315022cf20b.exe
File created	C:\Windows\SysWOW64\winnet.bmp	0209a4e555ed7df3fb6cd315022cf20b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4504	0209a4e555ed7df3fb6cd315022cf20b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4944	4504	0209a4e555ed7df3fb6cd315022cf20b.exe	90
PID 4504 wrote to memory of 4944	4504	0209a4e555ed7df3fb6cd315022cf20b.exe	90
PID 4504 wrote to memory of 4944	4504	0209a4e555ed7df3fb6cd315022cf20b.exe	90

C:\Users\Admin\AppData\Local\Temp\0209a4e555ed7df3fb6cd315022cf20b.exe
"C:\Users\Admin\AppData\Local\Temp\0209a4e555ed7df3fb6cd315022cf20b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\0209A4~1.EXE > nul
  2⤵
  PID:4944